Question

When should I use AWS NACL vs. Security Groups?

Answer 1

• AWS NACL: Use when you need to control traffic at the subnet level, or when you want to explicitly deny traffic between subnets or the internet.

  Example NACL rule:

  {
      "RuleNumber": 100,
      "Protocol": "tcp",
      "RuleAction": "allow",
      "CidrBlock": "0.0.0.0/0",
      "PortRange": {
          "From": 80,
          "To": 80
      }
  } 

• Security Groups: Use when you need to control traffic at the instance level based on ports and protocols, or when you want automatic stateful handling of traffic.

  Example Security Group rule (using AWS CLI):

  aws ec2 authorize-security-group-ingress --group-id sg-12345678 --protocol tcp --port 80 --cidr 0.0.0.0/0